Sophos Anti-Virus for Mac version 9.0 Preview

One possible issue, did a scan of my downloads folder, no threats found, but it says "Issues detected" but I can't find any way to see exactly what those issues are.

I also did a scan of my Downloads folder (lots of junk in there!).  Also reported "issues" but no threats.  I then looked in the scan log. 

2013-06-21 13:29:23 +1000 Corrupt file: /Volumes/MacHD/Users/john/Downloads/mediawiki-1.19.2.tar.gz
2013-06-21 13:54:08 +1000 Corrupt file: /Volumes/MacHD/Users/john/Downloads/XML/XMLSpear.dmg

XMLSpear.dmg opens fine in Finder - no verification errors.

mediawiki-1.19.2.tar.gz unpacks fine.

As further tests:

A. Downloaded the mediawiki file again and also two different versions (1.19.7 and 1.21.1) and scanned them - Sophos finds the 1.19.x files corrupt, but 1.21.1 is ok.   I got them from this Mediawiki mirror.   This does seem to be a repeatable problem with the 1.19.x files.

B. Other tar.gz files that I have are accepted by Sophos.

C. XMLSpear is horribly old and I don't think I could find it again  :-)

I should add that the scan was set to scan inside archives and compressed files.

---

mistabaka wrote:

One possible issue, did a scan of my downloads folder, no threats found, but it says "Issues detected" but I can't find any way to see exactly what those issues are.

---

Check the scan log (Preferences > Logging > View Log File, or directly via Console). Should give a hint or suggestion what has happened. Often "issues" are files which could not be scanned (encrypted, considered corrupt, etc).

---

gilby101 wrote:

A. Downloaded the mediawiki file again and also two different versions (1.19.7 and 1.21.1) and scanned them - Sophos finds the 1.19.x files corrupt, but 1.21.1 is ok.   I got them from this Mediawiki mirror.   This does seem to be a repeatable problem with the 1.19.x files.

---

The scanning engine needs to "unwind" archive files in order to figure out if any of the content is suspicious or outright known malware. This process usually involves decoding the archive format then decompressing the content for further inspection. In some cases, the engine is unable to parse files successfully because its been written in a non-standard way, or its encrypted, or its been damaged. In the cases of damage, the report of "corrupt" is accurate. In cases of encrypted content, the log will call out that its encrypted (not corrupt). In the rare case, its likely because we have stumbled into something unexpected and yet still report "corrupt".

Note that just because a given archive can be expanded doesn't necessarily imply its not corrupt (its just that some decompressors ignore decoding errors, but we generally do not). Also possible its a bug on our side. Thanks for the report and link, I'll get it reported to the right internal team.

Web Protection is a welcome addition, but I consider that there needs to be some discussion of privacy issues around this feature.  If I enable realtime URL reputation checks then there are one or more http conections to Sophos for every web page I visit.  Whilst this is providing protection it seems also provide Sophos (or anyone who taps the network connection) with a complete log of all the web pages I visit.

At present, I feel that the privacy issues are greater than the benefits and have turned this feature off at least until I have a better understanding of exactly what is transmitted and what Sophos does with the information.

But am I right in my understanding of how the feature operates?

Hello John,

it seems also provide Sophos (or anyone who taps the network connection) with a complete log of all the web pages I visit

an understandable concern but mostly unfounded. For HTTP anyone who taps the network connection can view requests for pages including headers and responses in full anyway so there's not much left that could be revealed by the lookups. The lookup itself contains just the URL (in somewhat encoded form) and the Sophos SXL version (the component which does the lookups) - nothing else, no browser info, no referrer, cookies or other data - and of course the originating IP (which could be those of a proxy) can be extracted from the connection. As repeated lookups for the same URL within a certain interval are avoided it doesn't produce a complete trail.

Thus - all that could identify you is the IP (if you're not using a proxy) and what could be recorded is an incomplete list of URL requests. Perhaps slightly useful of someone has no other information about you and your browsing behaviour. Now compare this to the "features" you usually find on a web page: Google Analytics and other statistics and counter tools, geolocation, various buttons, advertising and so on - all these collect much more information about you   

Christian

Christian's explanation is correct, we receive an encoded form of the URL hostname and path and the IP address of the originating computer (which might be a firewall or proxy). We don't capture any personally identifable or confidential information (we don't receive query args from the URL).

Our Web Protection feature is like the safe browsing functionality built into Safari, Chrome, Firefox, etc.

Additionally we periodically receive "feedback packets" - information about the performance of the software. This contains a unique identifier for your computer, but its randomly assigned when the software is installed. There is no way for Sophos to figure out which computer is yours.

We do store the URLs that are looked up, used for statistical analysis by SophosLabs. We don't store any association between URLs and endpoints e.g. we have no way to know which computer visited which website.

Hopefullyt that answers your concern. The most common vector for potentially malicious code to hit your computer is via the web. Surf safely, either with our product or that of someone else.

Bob & Christian,

Thank you both for your replies and the points you have made - I will consider them carefully.  You have provided more information on what is (and is not) transmitted as well as what data you do (and don't) record.  And that does go some way to reassure me.   I am one of those people who take some steps to cover tracks (blocking Google Analytics and tracking sites) without attempting to fully hide myself. ;-)

By the way, I have been using Sophos for Mac for a few years and everytime I consider moving to something else I always come back to knowing that Sophos for Mac meets my needs better than the competition (paid or free).  Thank you!

Hi carlos,

We've squashed a few memory leaks in version 9, although I will say that RAM usage has increased because we have more software running now. We added a couple of new processes. On my Mac running 10.8.4 I see "real mem" listed as: SophosConfigD 3.9 MB, SophosSXLD 25.3 MB, SophosWebIntelligence 11.1 MB, SophosScanD 226.5 MB. SophosScanD is big because it is running the full virus detection engine. Memory usage will vary a bit over time but shouldn't rise to infinity. Memory consumption is an important consideration and something we have more work planned for future versions.

We haven't made a lot of performance improvements to Intercheck in this update but I'm interested to hear more about how it performs for you e.g. how did you conclude its slow and what settings are you using. Thanks!